@agentproto/runtime 5.2.1 → 5.3.0

package/dist/{sessions-g4fw_zKx.d.ts → sessions-DKm6Wqro.d.ts}

@@ -1,10 +1,11 @@
 import { z } from 'zod';
-import { R as RouteSpec, S as SessionConfig, P as Posture, E as EffortLevel, C as ContextProfile, A as AuthMethod } from './session-config-RyRL2AbD.js';
-import { S as SpawnBrowserMode, R as ResolvedContextContinuityPolicy } from './context-continuity-BfNVbX5W.js';
+import { R as RouteSpec, S as SessionConfig, P as Posture, E as EffortLevel, C as ContextProfile, A as AuthMethod } from './session-config-DxIIuJFY.js';
+import { a as SpawnBrowserMode, R as ResolvedContextContinuityPolicy } from './spawn-defaults-Cp9SGZex.js';
 import { AcpPermissionResolution, AcpMcpServer } from '@agentproto/acp';
 import { SessionMode } from '@agentproto/acp/client';
 import { ChildProcess } from 'node:child_process';
 import { CostBudget } from '@agentproto/auth';
+import { h as WorktreeIsolationMode } from './config-DcESQDmZ.js';
 
 /**
  * Typed, best-effort persistence for the last-seen provider "remaining quota"
@@ -524,6 +525,210 @@ interface UsageDescriptorFields extends Omit<UsageDetail, "turns"> {
  */
 declare function projectSessionUsage(desc: UsageDescriptorFields): SessionUsage;
 
+/**
+ * Per-session process-tree resource sampler - answers "which session is
+ * eating this host" without a hand-written `ps` walk.
+ *
+ * One process-table read (`ps` on macOS/Linux, `/proc` as the Linux fallback
+ * when `ps` is missing) is attributed to sessions by climbing DOWN the tree
+ * from each live session's adapter pid, which the registry already knows -
+ * no env scraping for a session whose pid is known. Whatever is left over is
+ * bucketed:
+ *
+ *   - `daemon`        the daemon process itself + its own non-session children
+ *   - `provisioning`  daemon children spawned while a worktree provision is in
+ *                     flight (setup hooks: `pnpm install`, builds) - work that
+ *                     is not attached to a session yet
+ *   - `orphans`       processes that look agentproto-owned (a dead session's
+ *                     adapter-config dir / worktree in their args, or an
+ *                     `AGENTPROTO_SESSION_ID` / adapter-config env marker on a
+ *                     reparented process) but belong to no live session.
+ *                     Reported only - never killed.
+ *
+ * The expensive part (table + host reads) is cached for a short TTL and
+ * de-duplicated while in flight; attribution over the cached table is pure
+ * and cheap, so a burst of `session_list`/CLI/HTTP callers costs one `ps`.
+ *
+ * `%CPU` is whatever `ps` reports: the kernel's decayed (macOS) or
+ * lifetime-average (Linux) figure, not an instantaneous delta. That is the
+ * right lens for "what has this session been costing", and the same number an
+ * operator reads off `ps`/`top` - but it lags a sudden spike.
+ */
+
+/** One row of the host process table. */
+interface ProcRow {
+    pid: number;
+    ppid: number;
+    uid: number;
+    /** Resident set size in KiB (`ps` reports KiB on both macOS and Linux). */
+    rssKib: number;
+    /** `%CPU` as reported by the OS (may exceed 100 for multi-threaded work). */
+    cpuPercent: number;
+    /** Seconds since the process started. */
+    elapsedSec: number;
+    /** Full command line as one string. */
+    args: string;
+}
+/** Where the process table comes from. Injectable for tests. */
+type ProcessTableSource = () => Promise<ProcRow[]>;
+/**
+ * Collapse a raw command line to the short name an operator reads:
+ * `node …/pnpm.cjs install` → `pnpm install`, a vitest fork worker →
+ * `vitest`, `…/@esbuild/darwin-arm64/bin/esbuild --service` → `esbuild`,
+ * `…/claude-code/cli.js` → `claude`. Unrecognised node scripts stay `node`;
+ * anything else is its executable's basename (a macOS `.app` bundle is the
+ * app's name). Pure - no filesystem access.
+ */
+declare function normalizeCommand(args: string): string;
+interface CommandGroupStats {
+    /** Normalized command name (`pnpm install`, `vitest`, `git`, …). */
+    name: string;
+    count: number;
+    rssBytes: number;
+    cpuPercent: number;
+}
+interface ProcessDetail {
+    pid: number;
+    ppid: number;
+    /** Normalized name. */
+    command: string;
+    /** Raw command line, truncated. */
+    args: string;
+    rssBytes: number;
+    cpuPercent: number;
+    elapsedSec: number;
+    /** True when the process was attributed by env/args marker rather than by
+     *  descent from the session's adapter pid (a reparented stray). */
+    detached?: boolean;
+}
+interface ResourceStats {
+    rssBytes: number;
+    cpuPercent: number;
+    procCount: number;
+    /** Top command groups by RSS. */
+    topCommands: CommandGroupStats[];
+    /** Every process, largest RSS first - populated by `detail: "full"` only. */
+    processes?: ProcessDetail[];
+}
+interface SessionResourceStats extends ResourceStats {
+    sessionId: string;
+    /** The adapter pid the tree was climbed from. */
+    pid: number;
+}
+interface OrphanGroup extends ResourceStats {
+    /** Top of the orphaned subtree. */
+    pid: number;
+    command: string;
+    elapsedSec: number;
+    /** Session id the markers point at, when one was recoverable. */
+    sessionHint?: string;
+    /** Why this looks agentproto-owned. */
+    reason: string;
+}
+interface ProvisionInFlight {
+    sessionId?: string;
+    label?: string;
+    cwd: string;
+    startedAt: string;
+}
+interface ProvisioningStats extends ResourceStats {
+    inFlight: ProvisionInFlight[];
+}
+interface HostInfo {
+    platform: NodeJS.Platform;
+    cpuCount: number;
+    /** 1/5/15-minute load averages. */
+    loadAvg: [number, number, number];
+    totalMemBytes: number;
+    /** Memory available for new work - `MemAvailable` on Linux, free +
+     *  reclaimable pages on macOS, `os.freemem()` elsewhere. */
+    freeMemBytes: number;
+}
+type StatsDetail = "summary" | "full";
+interface ProcessStatsReport {
+    sampledAt: string;
+    detail: StatsDetail;
+    host: HostInfo;
+    sessions: SessionResourceStats[];
+    daemon: ResourceStats & {
+        pid: number;
+    };
+    provisioning: ProvisioningStats;
+    orphans: OrphanGroup[];
+    /** Sessions + daemon + provisioning. Orphans are reported separately and
+     *  are NOT in this sum (they belong to nobody). */
+    totals: {
+        rssBytes: number;
+        cpuPercent: number;
+        procCount: number;
+    };
+}
+interface ProvisionTracker {
+    begin(info: {
+        sessionId?: string;
+        label?: string;
+        cwd: string;
+    }): () => void;
+    list(): ProvisionInFlight[];
+}
+/** Run `fn` (a worktree provision) with the tracker marking it in flight. */
+declare function trackWorktreeProvision<T>(info: {
+    sessionId?: string;
+    label?: string;
+    cwd: string;
+}, fn: () => Promise<T>, tracker?: ProvisionTracker): Promise<T>;
+type HostInfoSource = () => Promise<HostInfo>;
+/** Read `pid → session id` markers from the environment of `pids`. Best
+ *  effort: Linux reads `/proc/<pid>/environ` (own uid only); macOS asks
+ *  `ps -E`, which some hardened setups blank out - a miss just means a stray
+ *  is judged by its command line alone. Never throws. */
+type EnvHintReader = (pids: readonly number[]) => Promise<Map<number, string>>;
+/** The slice of a registry descriptor the service reads. */
+interface StatsSessionDescriptor {
+    id: string;
+    pid?: number | null;
+    status: string;
+    adapterConfigDir?: string;
+    worktreePath?: string;
+    label?: string;
+    name?: string;
+    kind?: string;
+    adapterSlug?: string;
+}
+interface ProcessStatsServiceOptions {
+    table?: ProcessTableSource;
+    host?: HostInfoSource;
+    envHints?: EnvHintReader;
+    tracker?: ProvisionTracker;
+    daemonPid?: number;
+    uid?: number;
+    /** How long a sampled table is reused. Default 3000 ms. */
+    ttlMs?: number;
+    now?: () => number;
+}
+interface ProcessStatsService {
+    report(sessions: readonly StatsSessionDescriptor[], opts?: {
+        detail?: StatsDetail;
+        fresh?: boolean;
+    }): Promise<ProcessStatsReport>;
+}
+declare function createProcessStatsService(opts?: ProcessStatsServiceOptions): ProcessStatsService;
+/** Process-wide sampler shared by every surface (MCP, HTTP, CLI-over-HTTP),
+ *  so one `ps` per TTL serves them all. */
+declare function getProcessStatsService(): ProcessStatsService;
+interface LabeledSessionStats extends SessionResourceStats {
+    label?: string;
+    name?: string;
+    kind?: string;
+    status: string;
+    adapterSlug?: string;
+}
+interface LabeledProcessStatsReport extends Omit<ProcessStatsReport, "sessions"> {
+    sessions: LabeledSessionStats[];
+    /** Set for a subtree-scoped caller: host-wide buckets are withheld. */
+    scoped?: true;
+}
+
 /**
  * McpAppsHostService — the daemon as the MCP client that fetches MCP App
  * UIs (spec 2026-01-26) on behalf of a session's chat UI.
@@ -860,7 +1065,7 @@ interface ActivityRunStepSlice {
 interface ActivityWorkflowStageSlice {
     index: number;
     label?: string;
-    status: "pending" | "running" | "done" | "failed" | "skipped";
+    status: "pending" | "running" | "done" | "failed" | "skipped" | "cancelled";
     steps: readonly ActivityRunStepSlice[];
 }
 /** Structural slice of a `WorkflowRun` (`workflow_list` rows). */
@@ -1421,10 +1626,22 @@ interface CompletionPolicySupervisor {
  *
  * State machine (deliberately small):
  *   pending ⇄ in_progress → done | failed
- *   pending | in_progress → cancelled
+ *   in_progress ⇄ awaiting_approval → cancelled (denied)
+ *   pending | in_progress | awaiting_approval → cancelled
  *   done → pending only via an explicit reopen (creator/operator; bumps rev,
  *   records who in `meta.reopenedBy` — no silent resurrection)
  *
+ * Approval gate — `awaiting_approval` (E1b, on top of E1a's approvals
+ * engine): a task parked on one or more `approvalIds` (with an optional
+ * `artifacts` trail pointing at session artifacts or approval payloads).
+ * `linkApproval` is the synchronous wiring point a caller uses at
+ * `approval_request` time (see `session-event-bus.ts`'s
+ * `ApprovalRequestedEvent` doc); `task_update` can set the same fields
+ * directly. The ledger itself subscribes to `approval:decided`: approved →
+ * `in_progress`; denied → `cancelled` with `meta.reason = "denied"` — a
+ * SYSTEM transition, not subject to the update() ACL (mirrors `settleVerify`
+ * and `releaseTask` below).
+ *
  * Ownership (two roles, no per-field matrix):
  *   - `owner` absent = claimable. Claim is CAS — succeeds only if `owner` is
  *     absent AND `rev` matches; sets in_progress, appends to `sessions[]`.
@@ -1483,7 +1700,7 @@ interface CompletionPolicySupervisor {
  * turn-end-based auto-completion: a turn ending is not a task being done.
  */
 
-declare const TASK_STATUSES: readonly ["pending", "in_progress", "done", "failed", "cancelled"];
+declare const TASK_STATUSES: readonly ["pending", "in_progress", "awaiting_approval", "done", "failed", "cancelled"];
 type TaskStatus = (typeof TASK_STATUSES)[number];
 /** Parse a raw query/body value into a TaskStatus, or undefined when it
  *  isn't one — the `parseActivityState` idiom for the `/tasks` routes. */
@@ -1508,6 +1725,20 @@ type TaskVerification = {
     kind: "human";
     ts: string;
 };
+/**
+ * A link on a task, pointing either at a durable session artifact
+ * (`session-artifacts.ts` — content-addressed, `sessionId` + `key` +
+ * `sha256`) or at one of E1a's approval payloads (`approvalId`, resolved
+ * through the approvals engine). Opaque to the ledger — it never dereferences
+ * either shape, only stores and returns it.
+ */
+type TaskArtifactLink = {
+    sessionId: string;
+    key: string;
+    sha256: string;
+} | {
+    approvalId: string;
+};
 interface TaskRecord {
     taskId: string;
     /** Scope — see the board rules in the module docblock. */
@@ -1521,6 +1752,13 @@ interface TaskRecord {
     createdBy: string;
     /** INFORMATIONAL in v1 — no scheduler reads it. */
     blockedBy?: string[];
+    /** Approvals (E1a's `ApprovalRecord.id`s) gating this task. Set via
+     *  `linkApproval` or `task_update`. Driving one into `awaiting_approval`
+     *  requires this to end up non-empty. */
+    approvalIds?: string[];
+    /** Evidence trail — session artifacts and/or approval payload pointers.
+     *  See {@link TaskArtifactLink}. */
+    artifacts?: TaskArtifactLink[];
     /** Every session that ever claimed this task (append-only) — one of the
      *  two edges the Activity projector will join on later. */
     sessions?: string[];
@@ -1672,6 +1910,12 @@ interface TaskUpdateInput {
     };
     /** Free-text note, stamped into `meta.note` (last-write-wins). */
     note?: string;
+    /** Replace the linked approval ids. Owner-settable (like `note`) — not
+     *  gated behind the manager-only field-edit check. */
+    approvalIds?: string[];
+    /** Replace the linked artifact/approval evidence trail. Owner-settable,
+     *  same as `approvalIds`. */
+    artifacts?: TaskArtifactLink[];
 }
 /**
  * Every write verb answers with this three-way union: applied / rev-CAS
@@ -1699,6 +1943,17 @@ interface TaskLedger {
     get(taskId: string, caller: TaskCaller): TaskRecord | undefined;
     claim(input: TaskClaimInput, caller: TaskCaller): TaskWriteResult;
     update(input: TaskUpdateInput, caller: TaskCaller): TaskWriteResult;
+    /**
+     * Link an approval to a task — the synchronous wiring point a caller uses
+     * at `approval_request` time (see `ApprovalRequestedEvent`'s doc in
+     * `session-event-bus.ts`): appends `approvalId` to `approvalIds`
+     * (idempotent) and, when the task is `in_progress`, moves it to
+     * `awaiting_approval`. Requires owner or manager; the task must already be
+     * `in_progress` or `awaiting_approval` (a pending/closed task has nothing
+     * running to wait on). No `rev` — this is an internal wiring verb, not a
+     * caller-facing CAS write.
+     */
+    linkApproval(taskId: string, approvalId: string, caller: TaskCaller): TaskWriteResult;
     /** The caller's default board — the spawn-stamped `meta.boardId` (when
      *  present) else `tree:<root>` for a session caller, `ws:<workspaceSlug>`
      *  for the operator. Exposed so the tool/HTTP layers can echo it without
@@ -1783,7 +2038,7 @@ declare function isProviderLimitError(message: string | undefined): boolean;
  * and session_monitor MCP tool (long-poll multiplexed).
  */
 
-type SessionEventType = "session:turn-end" | "session:awaiting-input" | "session:awaiting-input-flagged" | "session:awaiting-question-answered" | "session:permission-request" | "session:permission-resolved" | "session:exited" | "session:reaped" | "session:stalled" | "session:stall-cleared" | "session:watcher-attached" | "session:watcher-detached" | "session:bg-tasks-parked" | "session:bg-tasks-cleared" | "session:bg-task" | "session:resumed" | "session:spawned" | "session:command-done" | "session:model-changed" | "session:config-changed" | "session:renamed" | "session:pinned-changed" | "session:artifact-added" | "session:artifact-pinned-changed" | "session:message" | "policy:passed" | "policy:failed" | "policy:commit-ready" | "policy:committed" | "cron:fired" | "cron:succeeded" | "cron:failed" | "activity:changed" | "task:changed" | "workflow:gate-report" | "workflow:suspended" | "workflow:suspend-resumed" | "session:harness-warning";
+type SessionEventType = "session:turn-end" | "session:awaiting-input" | "session:awaiting-input-flagged" | "session:awaiting-question-answered" | "session:permission-request" | "session:permission-resolved" | "session:exited" | "session:reaped" | "session:stalled" | "session:stall-cleared" | "session:watcher-attached" | "session:watcher-detached" | "session:bg-tasks-parked" | "session:bg-tasks-cleared" | "session:bg-task" | "session:resumed" | "session:spawned" | "session:provisioning" | "session:command-done" | "session:model-changed" | "session:config-changed" | "session:renamed" | "session:pinned-changed" | "session:artifact-added" | "session:artifact-pinned-changed" | "session:message" | "policy:passed" | "policy:failed" | "policy:commit-ready" | "policy:committed" | "cron:fired" | "cron:succeeded" | "cron:failed" | "activity:changed" | "task:changed" | "workflow:gate-report" | "workflow:suspended" | "workflow:suspend-resumed" | "session:harness-warning" | "approval:requested" | "approval:decided" | "approval:consumed" | "approval:expired";
 /**
  * Fixed severity vocabulary for a judge-gate finding (WP-D). Deliberately
  * small and fixed so `policy_status` output is comparable across different
@@ -2375,6 +2630,25 @@ interface SessionSpawnedEvent {
     depth: number;
     ts: string;
 }
+/**
+ * Emitted as a session's worktree provisioning moves through the daemon-wide
+ * provisioning queue: `queued` (waiting for a heavy-phase slot; `position` is
+ * the 1-based projected dispatch order), `started` (slot granted, heavy
+ * segment running), `phase` (entered another heavy phase), `done` (finished;
+ * `outcome` says how). `phase` names the heavy phase concerned. For a
+ * synchronous `agent_start` the `sessionId` is the id the session will have
+ * once provisioning finishes (no registry row exists before then).
+ */
+interface SessionProvisioningEvent {
+    type: "session:provisioning";
+    sessionId: string;
+    kind: "queued" | "started" | "phase" | "done";
+    phase?: "worktree" | "clone" | "deps" | "copy" | "setup";
+    position?: number;
+    outcome?: "ok" | "failed" | "cancelled";
+    label?: string;
+    ts: string;
+}
 /** Emitted by the supervisor when a completion policy's gate passes. */
 interface PolicyPassedEvent {
     type: "policy:passed";
@@ -2575,7 +2849,55 @@ interface SessionHarnessWarningEvent {
     label?: string;
     ts: string;
 }
-type SessionEvent = SessionTurnEndEvent | SessionAwaitingInputEvent | SessionAwaitingInputFlaggedEvent | SessionAwaitingQuestionAnsweredEvent | SessionPermissionRequestEvent | SessionPermissionResolvedEvent | SessionExitedEvent | SessionReapedEvent | SessionStalledEvent | SessionStallClearedEvent | SessionWatcherAttachedEvent | SessionWatcherDetachedEvent | SessionBgTasksParkedEvent | SessionBgTasksClearedEvent | SessionBgTaskEvent | SessionResumedEvent | SessionSpawnedEvent | SessionCommandDoneEvent | SessionModelChangedEvent | SessionConfigChangedEvent | SessionRenamedEvent | SessionPinnedEvent | SessionArtifactAddedEvent | SessionArtifactPinnedEvent | SessionMessageEvent | PolicyPassedEvent | PolicyFailedEvent | PolicyCommitReadyEvent | PolicyCommittedEvent | CronFiredEvent | CronSucceededEvent | CronFailedEvent | ActivityChangedEvent | TaskChangedEvent | WorkflowGateReportEvent | WorkflowApprovalRequestedEvent | WorkflowApprovalResolvedEvent | WorkflowSuspendedEvent | WorkflowSuspendResumedEvent | SessionHarnessWarningEvent;
+/**
+ * Emitted by the approvals engine (`approvals/engine.ts`) when an
+ * `approval_request` (MCP or `POST /approvals`) raises a new pending
+ * approval. `taskId` is present when the request is linked to a task —
+ * the task ledger uses it for nothing (linking already happened
+ * synchronously at request time via `TaskLedger.linkApproval`); it rides
+ * here purely for a listener's convenience.
+ */
+interface ApprovalRequestedEvent {
+    type: "approval:requested";
+    approvalId: string;
+    kind: string;
+    taskId?: string;
+    ts: string;
+}
+/**
+ * Emitted once a human decides a pending approval through a declared
+ * channel (`web_click`, `ui_card`) — never for anything else. The task
+ * ledger subscribes to this: a task in `awaiting_approval` whose
+ * `approvalIds` contains `approvalId` moves to `in_progress` on
+ * `decision:"approved"`, or `cancelled` (`meta.reason:"denied"`) on
+ * `decision:"denied"`.
+ */
+interface ApprovalDecidedEvent {
+    type: "approval:decided";
+    approvalId: string;
+    decision: "approved" | "denied";
+    channel: "web_click" | "ui_card";
+    taskId?: string;
+    ts: string;
+}
+/** Emitted when `approval_consume` (or its HTTP twin) atomically consumes
+ *  an approved approval — the gated action is now cleared to run exactly
+ *  once. */
+interface ApprovalConsumedEvent {
+    type: "approval:consumed";
+    approvalId: string;
+    taskId?: string;
+    ts: string;
+}
+/** Emitted when a pending approval's `expiresAt` (or its owning task's end)
+ *  lapses before a human decided. */
+interface ApprovalExpiredEvent {
+    type: "approval:expired";
+    approvalId: string;
+    taskId?: string;
+    ts: string;
+}
+type SessionEvent = SessionTurnEndEvent | SessionAwaitingInputEvent | SessionAwaitingInputFlaggedEvent | SessionAwaitingQuestionAnsweredEvent | SessionPermissionRequestEvent | SessionPermissionResolvedEvent | SessionExitedEvent | SessionReapedEvent | SessionStalledEvent | SessionStallClearedEvent | SessionWatcherAttachedEvent | SessionWatcherDetachedEvent | SessionBgTasksParkedEvent | SessionBgTasksClearedEvent | SessionBgTaskEvent | SessionResumedEvent | SessionSpawnedEvent | SessionProvisioningEvent | SessionCommandDoneEvent | SessionModelChangedEvent | SessionConfigChangedEvent | SessionRenamedEvent | SessionPinnedEvent | SessionArtifactAddedEvent | SessionArtifactPinnedEvent | SessionMessageEvent | PolicyPassedEvent | PolicyFailedEvent | PolicyCommitReadyEvent | PolicyCommittedEvent | CronFiredEvent | CronSucceededEvent | CronFailedEvent | ActivityChangedEvent | TaskChangedEvent | WorkflowGateReportEvent | WorkflowApprovalRequestedEvent | WorkflowApprovalResolvedEvent | WorkflowSuspendedEvent | WorkflowSuspendResumedEvent | SessionHarnessWarningEvent | ApprovalRequestedEvent | ApprovalDecidedEvent | ApprovalConsumedEvent | ApprovalExpiredEvent;
 interface SessionEventBus {
     emit(ev: SessionEvent): void;
     /** Subscribe to a specific event type. Returns an unsubscribe fn. */
@@ -2951,6 +3273,264 @@ interface SessionAppServeInfo {
     message?: string;
 }
 
+/**
+ * Policy layer for `agent_start.worktree` — the config-driven decision of
+ * WHETHER to isolate a spawn into its own git worktree, kept deliberately
+ * separate from HOW one is provisioned.
+ *
+ * This module holds no dependency on `@agentproto/worktree`. Same reasoning
+ * as `worktree-identity.ts`'s docblock, only stronger: provisioning runs the
+ * `worktree.provision` TOOL (git + the base tree's `agentproto.json` setup
+ * hooks), which would drag the driver/harness/provider graph into
+ * `@agentproto/runtime` for a capability the runtime only ever *triggers*.
+ * So the concrete provisioner is an INJECTED PORT ({@link WorktreeProvisioner})
+ * wired at the composition root by a host that already depends on the
+ * worktree package (the CLI). The runtime owns only the pure decision
+ * ({@link decideWorktreeIsolation}) and the config/env resolution
+ * ({@link loadWorktreeIsolation}) — both trivially unit-testable without git.
+ *
+ * Mirrors `agent_start.sandbox`'s `resolveSandboxProvider` injection shape,
+ * except sandbox can default its resolver inside the runtime (the runtime
+ * depends on `@agentproto/sandbox`); worktree cannot, so an unwired daemon
+ * simply has no provisioner and a spawn that would need one fails loud rather
+ * than silently spawning unisolated.
+ */
+
+/** Env override for the isolation policy. Highest-priority source, ahead of
+ *  the `worktrees.isolation` config field — see `loadWorktreeIsolation`. */
+declare const WORKTREE_ISOLATION_ENV = "AGENTPROTO_WORKTREES_ISOLATION";
+/** Env override for the daemon-wide cap on concurrently running HEAVY
+ *  worktree-provisioning segments (`depsCmd` etc.). Highest-priority source,
+ *  ahead of `worktrees.provisionConcurrency`. Enforced by
+ *  `@agentproto/worktree`'s scheduler (which reads the same env name); the
+ *  runtime only carries the name and the default for the config registry. */
+declare const WORKTREE_PROVISION_CONCURRENCY_ENV = "AGENTPROTO_WORKTREES_PROVISION_CONCURRENCY";
+/** Default cap on concurrently running heavy provisioning segments. Mirrors
+ *  `@agentproto/worktree`'s `DEFAULT_PROVISION_CONCURRENCY` (a CLI test pins
+ *  the two together — the runtime takes no dependency on that package). */
+declare const DEFAULT_WORKTREE_PROVISION_CONCURRENCY = 2;
+/** The default when nothing is configured. Back-compat-preserving: a caller
+ *  that passes no `worktree` field spawns exactly where it asked. */
+declare const DEFAULT_WORKTREE_ISOLATION: WorktreeIsolationMode;
+/**
+ * The `agent_start.worktree` field. `true` isolates with an auto-minted slug;
+ * an object additionally pins the slug and/or base ref, and can opt into
+ * async provisioning (`async: true` — see `WorktreeRequest.async`); `false`
+ * (or omitted) is "no explicit request" — the policy mode decides.
+ */
+type WorktreeField = boolean | {
+    slug?: string;
+    base?: string;
+    async?: boolean;
+};
+/** The caller's explicit request, normalized — `undefined` when the field is
+ *  absent or `false`, otherwise the (possibly empty) slug/base overrides. */
+interface WorktreeRequest {
+    slug?: string;
+    base?: string;
+    /** Return a real, registered session as soon as it's minted, provisioning
+     *  the worktree in the BACKGROUND instead of blocking `agent_start`'s
+     *  response on `git worktree add` + the repo's setup hooks (which can run
+     *  minutes — see `session-spawn.ts`'s async-provision branch).
+     *
+     *  DEFAULTS TO TRUE for any spawn that provisions a worktree, UNLESS this
+     *  spawn also carries `wait` (which needs a first turn to block on — see
+     *  `worktree_async_wait_conflict` — so the presence of `wait` alone falls
+     *  back to the synchronous path rather than conflicting by default). That
+     *  default is applied by `session-spawn.ts` itself (WP-H), not by this
+     *  field or `normalizeWorktreeField` — the normalizer leaves `async`
+     *  exactly as the caller sent it (`undefined` when omitted; see its own
+     *  test), so a caller inspecting the normalized request never sees a
+     *  value it didn't write. WP-H incident: the synchronous contract this
+     *  field opts OUT of — hold the RPC open for however long setup hooks
+     *  take, routinely minutes — is exactly what let a client's own request
+     *  timeout retry into a second live agent sharing the first one's
+     *  worktree (closed on the other side too — see `session-spawn.ts`'s
+     *  `findWorktreeLabelCwdCollision`, which now refuses that retry outright
+     *  rather than merely warning). Pass `false` explicitly to keep the old
+     *  blocking ok/fail contract (this package's own `worktree_provision_failed`
+     *  test coverage exercises it deliberately synchronous). */
+    async?: boolean;
+}
+/** What the runtime hands the provisioner. `cwd` is where the session would
+ *  otherwise spawn; the provisioner resolves the owning repo from it. */
+interface WorktreeProvisionRequest {
+    cwd: string;
+    /** Explicit slug from the caller; omitted ⇒ the provisioner mints a
+     *  collision-free one (see the host implementation). */
+    slug?: string;
+    /** Base ref the worktree branch is cut from; omitted ⇒ the provisioner's
+     *  default (`origin/main`). */
+    base?: string;
+    /** Free-text label (the session's `label`) the provisioner may fold into a
+     *  minted slug for human readability. Never load-bearing for correctness. */
+    labelHint?: string;
+    /** Absolute path the provisioner should append the setup hooks' FULL
+     *  stdout+stderr to (see `worktree.provision`'s `setupLogPath` input and
+     *  `@agentproto/worktree`'s `runSetup`). `session-spawn.ts` passes the
+     *  spawning session's own transcript dir here, so a failing setup hook's
+     *  full output survives even after a subsequently-reclaimed worktree is
+     *  gone — the short `HookError` message alone only carries a filtered
+     *  tail. Omitted callers (e.g. `agentproto worktree new`, no session to
+     *  log into) simply get no persisted log. */
+    setupLogPath?: string;
+    /** Re-run a failing `worktree.setup` command exactly once before giving
+     *  up — see `worktree.provision`'s `retrySetupOnFailure` input and
+     *  `runSetup`'s doc for why this is a bounded complement, not a
+     *  substitute, and why the daemon opts in while `agentproto worktree new`
+     *  doesn't. */
+    retrySetupOnFailure?: boolean;
+    /** Cancels this provisioning: a queued one is dropped from the daemon-wide
+     *  provisioning queue, a running one has its child process tree killed (no
+     *  orphaned `pnpm install`). The provisioner then rejects. */
+    signal?: AbortSignal;
+    /** Whose spawn this is, for the scheduler's fair-share dispatch (the parent
+     *  session id, or an anonymous key for a top-level spawn). */
+    callerId?: string;
+    /** Progress of the heavy provisioning segment (queued / started / phase /
+     *  done). Best-effort; never throws into the provisioner. */
+    onProgress?: (progress: WorktreeProvisionProgress) => void;
+}
+/** Phases of a worktree provisioning. `worktree` is the unthrottled
+ *  `git worktree add` step; the rest are the throttled heavy ones. */
+type WorktreeProvisionPhase = "worktree" | "clone" | "deps" | "copy" | "setup";
+/** Structural mirror of `@agentproto/worktree`'s `ProvisionProgress` (the
+ *  runtime deliberately takes no dependency on that package). */
+type WorktreeProvisionProgress = {
+    kind: "queued";
+    position: number;
+    phase: WorktreeProvisionPhase;
+} | {
+    kind: "started";
+    phase: WorktreeProvisionPhase;
+} | {
+    kind: "phase";
+    phase: WorktreeProvisionPhase;
+} | {
+    kind: "done";
+    outcome: "ok" | "failed" | "cancelled";
+};
+/** The provisioner's outcome. `isolated: false` is NOT a failure — it means
+ *  there was nothing to isolate (`cwd` sits in no git repo), and the caller
+ *  should spawn plain at the original cwd. A genuine failure throws. */
+type WorktreeProvisionOutcome = {
+    isolated: true;
+    cwd: string;
+    branch: string;
+} | {
+    isolated: false;
+    reason: "not-a-git-repo";
+};
+/**
+ * Injected port: provision a git worktree for `req.cwd` and return the
+ * worktree's own cwd for the spawn to land in. Wired at the composition root
+ * by the CLI (over `@agentproto/worktree`); absent on a bare runtime.
+ */
+type WorktreeProvisioner = (req: WorktreeProvisionRequest) => Promise<WorktreeProvisionOutcome>;
+/**
+ * Injected port: best-effort attempt to reclaim ONE worktree by path, called
+ * when its session reaches a terminal state (see
+ * `SessionDescriptor.worktreeAutoProvisioned` and `createSessionsRegistry`'s
+ * `runWorktreeAutoReclaim` option in `sessions.ts`). Deliberately scoped to
+ * exactly the one path a session's own exit is allowed to touch — never a
+ * repo-wide sweep. The implementation (wired by the CLI over
+ * `@agentproto/worktree`'s `reclaimOneWorktree`) re-classifies fresh and only
+ * ever removes the worktree when that comes back `reclaim` (merged-or-fresh,
+ * clean, idle) — a dirty or held worktree is simply left alone. Must never
+ * reject in a way the caller can't safely ignore; `sessions.ts` treats any
+ * rejection as "couldn't reclaim this time, leave it for a manual or
+ * scheduled `gc` sweep" and logs rather than lets it interrupt session
+ * teardown. Absent on a bare runtime — auto-reclaim is simply skipped, and a
+ * caller-explicit worktree request is never routed through this port at all
+ * (see `WorktreeDecision.provision.implicit`).
+ */
+type WorktreeAutoReclaimer = (worktreePath: string) => Promise<void>;
+/** The pure decision's three outcomes. `spawn-in-place` may carry a `warn`:
+ *  a non-fatal notice the caller should surface (the child is about to run in
+ *  a shared, dirty checkout it doesn't own). A `warn` never blocks the spawn —
+ *  it's the loud-but-legitimate middle ground between silently spawning into a
+ *  shared tree and hard-rejecting an in-place spawn that's normal at depth.
+ *  `provision.implicit` is `true` exactly when the caller made no explicit
+ *  `worktree` request and the `"always"` policy provisioned one anyway (the
+ *  worktree the caller never asked to keep) — `false` whenever the request
+ *  came from the caller itself (`on-request`'s only path here, or `"always"`
+ *  with an explicit field). This is the signal `session-spawn.ts` threads
+ *  onto the session descriptor so exit-time auto-reclaim (`sessions.ts`)
+ *  only ever touches a worktree the daemon minted on its own — a worktree a
+ *  caller explicitly asked to keep is never auto-removed. */
+type WorktreeDecision = {
+    action: "spawn-in-place";
+    warn?: string;
+} | {
+    action: "provision";
+    request: WorktreeRequest;
+    implicit: boolean;
+} | {
+    action: "reject";
+    message: string;
+};
+/**
+ * Normalize the raw field into an explicit request, or `undefined` when the
+ * caller made no request (`false` / omitted). An object with no overrides
+ * still counts as a request (`{}`) — the caller opted in, just without pins.
+ */
+declare function normalizeWorktreeField(field: WorktreeField | undefined): WorktreeRequest | undefined;
+/**
+ * The resolution matrix — mode × explicit-request × depth — with no side
+ * effects. Every branch is exercised in `worktree-isolation.test.ts`.
+ *
+ * Depth-0 gate: a nested spawn (`depth > 0`, i.e. made through the scoped
+ * orchestrator sub-gateway) NEVER provisions a worktree of its own — it
+ * inherits its parent's ground, per AIP-46 §Delegation. This bites before
+ * the mode is even consulted, so `always` too provisions only at the root.
+ * But "never provisions" is NOT "silently ignore an explicit request": a
+ * nested caller that passes an EXPLICIT `worktree` (`true` / `{slug}`) asked
+ * for isolation and would silently get none — the spawn quietly runs in the
+ * shared checkout, exactly the footgun that nearly clobbered a shared tree.
+ * So an explicit request at depth > 0 is REJECTED loudly (same shape as the
+ * `never`-policy reject below), pointing the caller at sandbox isolation —
+ * child isolation is the sandbox, not a second worktree. Only the IMPLICIT/
+ * absent case (`undefined` / `false`) stays an in-place spawn: the child is
+ * meant to share the parent's tree and made no request to the contrary.
+ *
+ * That implicit case still has a footgun, though: the inherited cwd may be a
+ * LIVE, DIRTY, shared checkout (the real repo, not a daemon-provisioned
+ * worktree) — spawning in place there lets a nested child edit a tree someone
+ * else is actively working in. We don't hard-reject it (implicit in-place is
+ * legitimate and common), but we DON'T stay silent either: when the caller
+ * hands us `sharedDirtyCwd` (an impure signal it computed — see
+ * `session-spawn.ts`), the in-place spawn carries a `warn`. A caller that
+ * genuinely intends it passes `allowSharedCwd` to acknowledge and silence the
+ * warning. The signal is only consulted for the implicit nested case; every
+ * other branch ignores it, keeping the root matrix unchanged.
+ */
+declare function decideWorktreeIsolation(input: {
+    mode: WorktreeIsolationMode;
+    field: WorktreeField | undefined;
+    depth: number;
+    /** Impure signal, computed by the caller (never inside this pure fn): the
+     *  inherited cwd is a git work tree that is DIRTY and NOT a daemon-
+     *  provisioned worktree — i.e. a shared checkout the child would edit in
+     *  place. Only consulted for an implicit nested spawn. */
+    sharedDirtyCwd?: boolean;
+    /** Caller's explicit acknowledgement that spawning into a shared dirty cwd
+     *  is intended — silences the `sharedDirtyCwd` warning. */
+    allowSharedCwd?: boolean;
+}): WorktreeDecision;
+/** Parse a raw string into a valid mode, or `undefined` when it isn't one. */
+declare function parseWorktreeIsolationMode(raw: string | undefined): WorktreeIsolationMode | undefined;
+/**
+ * Resolve the effective isolation mode: env > config field > default. Mirrors
+ * `resolveWorktreesRoot`'s precedence (there's no flag layer — this is read
+ * daemon-side at spawn, not from an invocation). Never throws: an unreadable
+ * config falls through to the default.
+ */
+declare function loadWorktreeIsolation(loadCfg?: () => Promise<{
+    worktrees?: {
+        isolation?: WorktreeIsolationMode;
+    };
+}>): Promise<WorktreeIsolationMode>;
+
 /** One background task as mirrored onto `SessionDescriptor.backgroundTasks`. */
 interface SessionBackgroundTask {
     taskId: string;
@@ -3649,6 +4229,24 @@ interface SessionHandoff {
     /** ISO 8601 timestamp the handoff spawn completed. */
     at: string;
 }
+/**
+ * Where a still-`starting` session's worktree provisioning stands in the
+ * daemon-wide provisioning queue (heavy phases, `depsCmd` above all, are
+ * throttled so a burst of spawns cannot melt the host). Present only while
+ * provisioning is in flight; cleared when it finishes, fails, or is cancelled.
+ */
+interface SessionProvisioning {
+    /** `queued`: waiting for a heavy-phase slot. `running`: provisioning is
+     *  actually executing (the cheap prep, or a granted heavy segment). */
+    state: "queued" | "running";
+    /** 1-based projected dispatch position; only while `queued`. */
+    position?: number;
+    /** The phase queued for (`queued`) or currently executing (`running`). */
+    phase: WorktreeProvisionPhase;
+    /** ISO-8601 instant provisioning began (the spawn), constant across the
+     *  queued and running states so `now - startedAt` is the total wait. */
+    startedAt: string;
+}
 interface SessionDescriptor {
     id: string;
     kind: SessionKind;
@@ -3658,6 +4256,9 @@ interface SessionDescriptor {
     command: string;
     pid: number | null;
     status: SessionStatus;
+    /** Worktree-provisioning progress of a `starting` row — see
+     *  {@link SessionProvisioning}. Absent once the session left `starting`. */
+    provisioning?: SessionProvisioning;
     /** Unambiguous liveness signal, stamped at read time (list()/get()/
      *  findByIdOrName) — true iff `status` is "running" or "starting", the
      *  same test the daemon uses internally (validateAgentTurn). Ephemeral:
@@ -3788,6 +4389,11 @@ interface SessionDescriptor {
      *  `withMemory: true`) since it costs a `ps` spawn; absent otherwise, and
      *  absent for a row with no `pid` or that `ps` didn't report. */
     rssBytes?: number;
+    /** Process-tree resource sample for this session (`process-stats.ts`):
+     *  RSS, %CPU, process count, top commands by RSS - plus, at `stats:"full"`,
+     *  every process. Ephemeral and opt-in (`session_list`/`agent_sessions_list`
+     *  `stats`), never persisted; absent for a row with no live process. */
+    stats?: Omit<SessionResourceStats, "sessionId">;
     /** Count of live supervisors currently blocked waiting on this session —
      *  HTTP `GET /sessions/:id/wait` long-polls and `session_monitor`
      *  subscriptions, both via `monitorSessionWait` (#session-visibility).
@@ -4611,10 +5217,13 @@ interface SessionDescriptor {
     contextContinuityAckedAtPct?: number;
     /** Id of the most recent checkpoint created for this session. */
     checkpointId?: string;
-    /** When this session was continued fresh, the source session id. */
+    /** The source session id when this row continues another one: a
+     *  continue-fresh handoff OR a revival (restart / cron / sentinel / inbound
+     *  wake / direct resume of the same adapter conversation — also recorded as
+     *  `resumedFrom`). Absent on a row that started a conversation. */
     continuedFrom?: string;
-    /** When this session was continued fresh into a new session, the target
-     *  session id. */
+    /** The row that continued this one (the inverse of `continuedFrom`); the
+     *  latest continuation wins when a row is revived more than once. */
     continuedTo?: string;
     /** Set alongside `continuedFrom` on the NEW session — the harness the
      *  checkpoint moved from/to and when. Present on every `continue_fresh`
@@ -4749,6 +5358,9 @@ interface SessionSummary {
     command: string;
     pid: number | null;
     status: SessionStatus;
+    /** Worktree-provisioning progress while `starting` — see
+     *  `SessionDescriptor.provisioning`. */
+    provisioning?: SessionProvisioning;
     startedAt: string;
     endedAt?: string;
     exitCode?: number;
@@ -4820,6 +5432,9 @@ interface SessionSummary {
      *  `SessionDescriptor.lastTurnErroredAt`. Stamped at turn-end, cleared on
      *  the next turn that completes without one. */
     lastTurnErroredAt?: string;
+    /** `SessionDescriptor.lastError` (spawn/crash cause), capped at 2000 chars
+     *  for the list projection. Lets a list view say WHY an errored row died. */
+    lastError?: string;
     origin?: string;
     parentSessionId?: string;
     depth?: number;
@@ -5088,6 +5703,13 @@ interface SessionsRegistry {
      *  killed it mid-provision. A terminal descriptor is never resurrected.
      *  Also a no-op for an unknown id (the row was removed entirely). */
     settlePendingAgent(id: string, outcome: PendingAgentOutcome): void;
+    /** Record a provisioning progress report for `id`: updates the row's
+     *  {@link SessionProvisioning} (`queued` / `started` / `phase`; `done`
+     *  clears it) and emits `session:provisioning` on the bus. Also emits for an
+     *  id with no registry row (a synchronous provision, whose session doesn't
+     *  exist until it finishes) — only the descriptor update is skipped. Never
+     *  touches a row that already left `starting`. */
+    reportProvisioning(id: string, progress: WorktreeProvisionProgress): void;
     /** Spawn a process under a real PTY (node-pty). Bytes flow through
      *  the registry's byte ring buffer + emitter; attach with
      *  `attachPty(id, ...)`. Throws when the registry was constructed
@@ -5401,6 +6023,13 @@ interface SessionsRegistry {
      * builds the fully-typed event (axis + value already reflected on the new
      * descriptor); the registry only forwards it. */
     emitConfigChanged(ev: SessionConfigChangedEvent): void;
+    /**
+     * Announce a `session:harness-warning` for a session — an explicit,
+     * non-fatal "the host could not honor part of what was asked" notice (the
+     * app-boundary fs zones not enforceable on this harness, …). Best-effort
+     * observability; no-op when the registry has no event bus.
+     */
+    emitHarnessWarning(sessionId: string, warnings: readonly string[], label?: string): void;
     /**
      * Switch the reasoning/compute budget (effort) on a LIVE agent-cli session
      * without restarting it — the live-effort verb (SPEC §4.2, build step 5),
@@ -6074,7 +6703,13 @@ interface SpawnAgentInput {
 /** `SpawnAgentInput` minus the fields that only exist once the driver's
  *  `startSession` has actually run — see `spawnAgentPending`'s doc for why
  *  everything else is safe to record up front. */
-type SpawnAgentPendingInput = Omit<SpawnAgentInput, "agentSession" | "commandPreview" | "resumable" | "nativeTerminalResume" | "initialPrompt">;
+type SpawnAgentPendingInput = Omit<SpawnAgentInput, "agentSession" | "commandPreview" | "resumable" | "nativeTerminalResume" | "initialPrompt"> & {
+    /** Invoked once when the placeholder reaches a terminal status (killed, or
+     *  settled failed) while provisioning may still be in flight — the hook
+     *  that aborts the provisioner so a killed spawn leaves no queued entry
+     *  and no orphaned install. Never invoked after a successful settle. */
+    onCancel?: () => void;
+};
 /** The deferred outcome `settlePendingAgent` resolves a placeholder with —
  *  see that method's doc. */
 type PendingAgentOutcome = {
@@ -6228,4 +6863,4 @@ interface RecordOpenedPrInput {
     url: string;
 }
 
-export { MESSAGE_URGENCIES as $, type ActivityPolicySlice as A, type PtyFactory as B, type CompletionPolicySupervisor as C, type ActivityKind as D, type ActivitySource as E, type ActivityState as F, type ActivityWaitingOn as G, type AnthropicReaderConfig as H, AnthropicRemainingQuotaReader as I, type AttachPolicyInput as J, type CommitSpec as K, type EagerResumeFailReason as L, type MessageUrgency as M, type EagerResumeOutcome as N, type EagerResumeSkipReason as O, type PrResolvedState as P, type QuotaReadableProfile as Q, type RestartPolicy as R, type SessionEvent as S, type TaskLedger as T, type UserPreset as U, type GateSpec as V, type JudgeGateSpec as W, MAX_MESSAGE_DATA_BYTES as X, MESSAGE_KINDS as Y, MESSAGE_PREAMBLE as Z, MESSAGE_TAG as _, type SessionEventType as a, escapeMessageBody as a$, type MessageDeliveryVia as a0, type MessageFilter as a1, type MessageRelation as a2, type MessageTreeNode as a3, type OnFailSpec as a4, type PendingPermission as a5, type PermissionRespondInput as a6, type PermissionRespondResult as a7, type PolicyRunStatus as a8, type PricingResolver as a9, type TaskGateOutcome as aA, type TaskGateRunner as aB, type TaskLedgerRegistry as aC, type TaskLedgerSessionSlice as aD, type TaskListFilter as aE, type TaskRecord as aF, type TaskStatus as aG, type TaskUpdateInput as aH, type TaskVerification as aI, type TaskVerifySupervisor as aJ, type TaskWriteResult as aK, type TokenPricing as aL, type UsageBucket as aM, type UsageComputeInput as aN, type UsageDetail as aO, type UsageSource as aP, type UserPresetsFile as aQ, WORKSPACE_SLUG_ENV as aR, activityCounts as aS, compactOutcome as aT, createSessionMessage as aU, createSupervisorTaskGateRunner as aV, createTaskLedger as aW, deleteUserPreset as aX, deriveSessionOutcome as aY, deriveSessionUsage as aZ, escapeHumanPrompt as a_, type QuotaStoreFile as aa, type QuotaStoreOptions as ab, type RegisterBrowserInput as ac, type RegisterSessionInput as ad, type RemainingQuota as ae, ResumeDisabledError as af, SESSION_END_REASONS as ag, SESSION_ID_ENV as ah, type SessionCurrentPhase as ai, type SessionKind as aj, type SessionMessageFrom as ak, type SessionOutcome as al, type SessionOutcomeArtifact as am, type SessionOutcomeCompact as an, type SessionOutcomeLink as ao, type SessionSnapshots as ap, type SessionStatus as aq, type ShellGateSpec as ar, type SpawnAgentInput as as, type SpawnSessionInput as at, type StoredProfileQuota as au, TASK_STATUSES as av, type TaskCaller as aw, type TaskChangedEvent as ax, type TaskClaimInput as ay, type TaskCreateInput as az, type SessionEventBus as b, filterActivities as b0, getUserPreset as b1, isClosedTaskStatus as b2, isKnownSessionEndReason as b3, isMessageAllowed as b4, isProviderLimitError as b5, isTerminalActivityState as b6, listUserPresets as b7, loadQuotaStore as b8, loadUserPresets as b9, userPresetSchema as bA, matchesMessageFilter as ba, messageFrom as bb, mintMessageId as bc, parseAnthropicRateLimitHeaders as bd, parseTaskStatus as be, parseWindow as bf, pickUsageDetail as bg, policyToActivities as bh, policyWatchesSession as bi, prToActivities as bj, projectSessionUsage as bk, readProfileQuota as bl, recordProfileQuota as bm, renderInboxDigest as bn, renderSessionMessage as bo, renderSessionMessages as bp, resolveRelation as bq, rollupUsage as br, sanitizeLabel as bs, saveUserPreset as bt, turnToActivities as bu, userPresetsPath as bv, workflowToActivities as bw, type RecentSpawnConfig as bx, deriveRecentSpawnConfigs as by, touchUserPreset as bz, type SessionsRegistry as c, type SessionDescriptor as d, type SessionEndReason as e, type ActivityListFilter as f, type ActivityRecord as g, type ActivityTurnSession as h, type ActivityPrSession as i, type ActivityWorkflowRunSlice as j, type ActivityTaskSlice as k, type AgentsMdResolution as l, type SandboxAppServeSpec as m, type AgentSessionLike as n, type UsageReadContext as o, type UsageReadResult as p, type MessageKind as q, type SessionMessage as r, type AgentStreamEvent as s, type SessionUsage as t, type ToolCallRecord as u, type UsageRollup as v, type RemainingQuotaReader as w, type UsageSnapshotRecord as x, type SessionAwaitingQuestion as y, type PolicyRunState as z };
+export { DEFAULT_WORKTREE_PROVISION_CONCURRENCY as $, type ActivityPolicySlice as A, type UsageRollup as B, type CompletionPolicySupervisor as C, type RemainingQuotaReader as D, type UsageSnapshotRecord as E, type SessionAwaitingQuestion as F, type PolicyRunState as G, type PtyFactory as H, type WorktreeAutoReclaimer as I, type ActivityKind as J, type ActivitySource as K, type ActivityState as L, type MessageUrgency as M, type ActivityWaitingOn as N, type AnthropicReaderConfig as O, type PrResolvedState as P, type QuotaReadableProfile as Q, type RestartPolicy as R, type SessionEvent as S, type TaskLedger as T, type UserPreset as U, AnthropicRemainingQuotaReader as V, type WorktreeProvisioner as W, type AttachPolicyInput as X, type CommandGroupStats as Y, type CommitSpec as Z, DEFAULT_WORKTREE_ISOLATION as _, type SessionEventType as a, type TaskUpdateInput as a$, type EagerResumeFailReason as a0, type EagerResumeOutcome as a1, type EagerResumeSkipReason as a2, type GateSpec as a3, type HostInfo as a4, type JudgeGateSpec as a5, type LabeledProcessStatsReport as a6, type LabeledSessionStats as a7, MAX_MESSAGE_DATA_BYTES as a8, MESSAGE_KINDS as a9, type SessionCurrentPhase as aA, type SessionKind as aB, type SessionMessageFrom as aC, type SessionOutcome as aD, type SessionOutcomeArtifact as aE, type SessionOutcomeCompact as aF, type SessionOutcomeLink as aG, type SessionResourceStats as aH, type SessionSnapshots as aI, type SessionStatus as aJ, type ShellGateSpec as aK, type SpawnAgentInput as aL, type SpawnSessionInput as aM, type StatsDetail as aN, type StoredProfileQuota as aO, TASK_STATUSES as aP, type TaskCaller as aQ, type TaskChangedEvent as aR, type TaskClaimInput as aS, type TaskCreateInput as aT, type TaskGateOutcome as aU, type TaskGateRunner as aV, type TaskLedgerRegistry as aW, type TaskLedgerSessionSlice as aX, type TaskListFilter as aY, type TaskRecord as aZ, type TaskStatus as a_, MESSAGE_PREAMBLE as aa, MESSAGE_TAG as ab, MESSAGE_URGENCIES as ac, type MessageDeliveryVia as ad, type MessageFilter as ae, type MessageRelation as af, type MessageTreeNode as ag, type OnFailSpec as ah, type OrphanGroup as ai, type PendingPermission as aj, type PermissionRespondInput as ak, type PermissionRespondResult as al, type PolicyRunStatus as am, type PricingResolver as an, type ProcessDetail as ao, type ProcessStatsReport as ap, type ProcessStatsService as aq, type QuotaStoreFile as ar, type QuotaStoreOptions as as, type RegisterBrowserInput as at, type RegisterSessionInput as au, type RemainingQuota as av, type ResourceStats as aw, ResumeDisabledError as ax, SESSION_END_REASONS as ay, SESSION_ID_ENV as az, type SessionEventBus as b, sanitizeLabel as b$, type TaskVerification as b0, type TaskVerifySupervisor as b1, type TaskWriteResult as b2, type TokenPricing as b3, type UsageBucket as b4, type UsageComputeInput as b5, type UsageDetail as b6, type UsageSource as b7, type UserPresetsFile as b8, WORKSPACE_SLUG_ENV as b9, isProviderLimitError as bA, isTerminalActivityState as bB, listUserPresets as bC, loadQuotaStore as bD, loadUserPresets as bE, loadWorktreeIsolation as bF, matchesMessageFilter as bG, messageFrom as bH, mintMessageId as bI, normalizeCommand as bJ, normalizeWorktreeField as bK, parseAnthropicRateLimitHeaders as bL, parseTaskStatus as bM, parseWindow as bN, parseWorktreeIsolationMode as bO, pickUsageDetail as bP, policyToActivities as bQ, policyWatchesSession as bR, prToActivities as bS, projectSessionUsage as bT, readProfileQuota as bU, recordProfileQuota as bV, renderInboxDigest as bW, renderSessionMessage as bX, renderSessionMessages as bY, resolveRelation as bZ, rollupUsage as b_, WORKTREE_ISOLATION_ENV as ba, WORKTREE_PROVISION_CONCURRENCY_ENV as bb, type WorktreeDecision as bc, type WorktreeProvisionOutcome as bd, type WorktreeProvisionPhase as be, type WorktreeProvisionProgress as bf, type WorktreeProvisionRequest as bg, type WorktreeRequest as bh, activityCounts as bi, compactOutcome as bj, createProcessStatsService as bk, createSessionMessage as bl, createSupervisorTaskGateRunner as bm, createTaskLedger as bn, decideWorktreeIsolation as bo, deleteUserPreset as bp, deriveSessionOutcome as bq, deriveSessionUsage as br, escapeHumanPrompt as bs, escapeMessageBody as bt, filterActivities as bu, getProcessStatsService as bv, getUserPreset as bw, isClosedTaskStatus as bx, isKnownSessionEndReason as by, isMessageAllowed as bz, type SessionsRegistry as c, saveUserPreset as c0, trackWorktreeProvision as c1, turnToActivities as c2, userPresetsPath as c3, workflowToActivities as c4, type RecentSpawnConfig as c5, deriveRecentSpawnConfigs as c6, touchUserPreset as c7, userPresetSchema as c8, type SessionDescriptor as d, type SessionEndReason as e, type ActivityListFilter as f, type ActivityRecord as g, type ActivityTurnSession as h, type ActivityPrSession as i, type ActivityWorkflowRunSlice as j, type ActivityTaskSlice as k, type AgentsMdResolution as l, type SandboxAppServeSpec as m, type WorktreeField as n, type AgentSessionLike as o, type UsageReadContext as p, type UsageReadResult as q, type MessageKind as r, type SessionMessage as s, type AgentStreamEvent as t, type SessionUsage as u, type ToolCallRecord as v, type StatsSessionDescriptor as w, type ProcRow as x, type ProvisionInFlight as y, type ProvisionTracker as z };